NSA Reform Bill Passes the House—With a Gaping Loophole

NSA headquarters in Fort Meade, Maryland. Image: Courtesy NSA

The U.S. House of Representatives has passed a bill that would end the NSA’s mass collection of Americans’ phone records. Unfortunately, it may not end the NSA’s mass collection of Americans’ phone records.

The House voted 303 to 121 Thursday in favor of the USA Freedom Act, broad legislation aimed at reforming the NSA’s surveillance powers exposed by Edward Snowden. The central provision of the bill, which now moves on to debate in the Senate, is intended to limit what the intelligence community calls “bulk” collection–the indiscriminate vacuuming up of citizen’s phone and internet records. But privacy advocates and civil libertarians say last-minute changes to the legislation supported by the White House added ambiguous language that could essentially give the NSA a generous loophole through which it can continue its massive domestic data collection.

In the House’s final version of the bill, the NSA would be stripped of the power to collect all Americans’ phone records for metadata analysis, a practice revealed in the first Guardian story about Snowden’s leaks published last year. It instead would be required to limit its collection to specific terms. The problem is that those terms may not be nearly specific enough, and could still include massive lists of target phone numbers or entire ranges of IP addresses.

“The core problem is that this only ends ‘bulk’ collection in the sense the intelligence community uses that term,” says Julian Sanchez, a researcher at the Cato Institute. “As long as there’s some kind of target, they don’t call that bulk collection, even if you’re still collecting millions of records…If they say ‘give us the record of everyone who visited these thousand websites,’ that’s not bulk collection, because they have a list of targets.”

“To any normal person,” he adds, “that’s still pretty bulky.”

Specifically, the House changed the definition of a search term from “a term used to uniquely describe a person, entity, or account” to “a discrete term, such as a term specifically identifying a person, entity, account, address, or device.” That shift, particularly the removal of the word “unique” and addition of “such as,” might be enough to enable nearly the same sort of mass surveillance the NSA now conducts, according to a statement from the New America Foundation’s Open Technology Institute.

“Taken together,” the Institute wrote, “the changes to this definition may still allow for massive collection of millions of Americans’ private information based on very broad selection terms such as a zip code, an area code, the physical address of a particular email provider or financial institution, or the IP address of a web hosting service that hosts thousands of web sites.”

Of course, how those “specific terms” are defined in practice will be decided by the Foreign Intelligence Surveillance Court, which must approve NSA requests for data collection under the 214 and 215 provisions of the Foreign Intelligence Surveillance Act. But after a year of revelations that have showed how the NSA uses word games to expand its legal powers, Kevin Bankston of the the Open Technology Institute says the court can’t be fully trusted to interpret the law strictly. “The danger is that it’s ambiguous, and if the FISA court and the NSA has showed us anything, it’s that any ambiguity in these laws is dangerous,” Bankston says.

In fact, the watered-down version of the Freedom Act passed by the House also weakens early provisions that would have provided more resistance against the NSA in its FISA arguments, Sanchez says. The earlier version of the bill would have established a “public advocate” to argue against the NSA in FISA proceedings; the current bill has only a weaker “amicus” option, something closer to an outside adviser to the court.

The bulk surveillance element of the bill is but one point its critics are disappointed to see pass the House. The Open Technology Institute, the Electronic Frontier Foundation, and the anti-surveillance group Access Now allpublishedstatements enumerating the bill’s flaws. Other problems they cite include the removal of provisions giving companies more freedom to report the intelligence community’s demands for users’ data, and a provision that still allows the NSA to collect information “about” a target; Rather than limiting data collection to communications sent to or from that target, the measure that would allow mass data collection that sweeps in any communications that are reference the target but may not involve that person.

Despite all those problems, some policy-watchers still see the passage of the Freedom Act in the House as a step towards real reform. They’re also holding out hope that the bill could be amended–and its teeth reinserted–in the Senate. “While far from perfect, this bill is an unambiguous statement of congressional intent to rein in the out-of-control NSA,” reads a statement from Laura Murphy, the American Civil Liberties Union’s Washington legislative director. “While we share the concerns of many–including members of both parties who rightly believe the bill does not go far enough–without it we would be left with no reform at all, or worse, a House Intelligence Committee bill that would have cemented bulk collection of Americans’ communications into law. We will fight to secure additional improvements in the Senate.”